Some UDP (and RPC) daemons linger around for a while after they have finished their work, in case another request comes in. In the inetd configuration file these services are registered with the wait option. Only the request that started such a daemon will be logged.
The program does not work with RPC services over TCP. These services are registered as rpc/tcp in the inetd configuration file. The only non-trivial service that is affected by this limitation is rexd, which is used by the on(1) command. This is no great loss. On most systems, rexd is less secure than a wildcard in /etc/hosts.equiv.
RPC broadcast requests (for example: rwall, rup, rusers) always appear to come from the responding host. What happens is that the client broadcasts the request to all portmap daemons on its network; each portmap daemon forwards the request to a local daemon. As far as the rwall etc. daemons know, the request comes from the local host.
The default locations of the host access control tables are:
hosts_access(5), format of the tcpd access control tables.syslog.conf(5), format of the syslogd control file.inetd.conf(5), format of the inetd control file.